WordPress Plugin Vulnerabilities

Master Blocks 1.4.1 - 1.4.1.4 - Unauthenticated Stored XSS via White Label Settings

Description

The plugin does not have authorisation on one of its REST routes, allowing unauthenticated users to update its settings, including a value that is output unescaped in the admin area, leading to Stored XSS that executes in the session of any administrator visiting a wp-admin page.

Proof of Concept

Affects Plugins

Plugin icon
ultimate-blocks-for-gutenberg
Fixed in 1.5.0

References

CVE
CVE-2026-88824

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
8.8 (high)

Miscellaneous

Original Researcher
Enrico Marcolini - Claudio Marchesini - Dottor Marc
Submitter
Enrico Marcolini - Claudio Marchesini - Dottor Marc
Submitter website
https://www.dottormarc.it
Verified
Yes
WPVDB ID
898fda0a-4d27-4def-ae6f-35bf25a8ae8d

Timeline

Publicly Published
2026-09-17 (about 2 days ago)
Added
2026-09-17 (about 1 day ago)
Last Updated
2026-09-18 (about 8 hours ago)

Other

Published
Title
Published
2024-11-04
Title
Admin Amplify <= 1.3.0 - Reflected Cross-Site Scripting
Published
2025-12-30
Title
Team Showcase < 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-03-29
Title
Weekly Class Schedule <= 3.19 - Reflected Cross-Site Scripting
Published
2014-08-01
Title
bib2html 0.9.3 - /OSBiB/create/index.php styleShortName Parameter XSS
Published
2023-04-18
Title
YellowPencil Visual CSS Style Editor < 7.5.9 - Admin+ Stored XSS